summaryrefslogtreecommitdiff
path: root/src/conf_mode/vyos_cert.py
diff options
context:
space:
mode:
Diffstat (limited to 'src/conf_mode/vyos_cert.py')
-rwxr-xr-xsrc/conf_mode/vyos_cert.py147
1 files changed, 0 insertions, 147 deletions
diff --git a/src/conf_mode/vyos_cert.py b/src/conf_mode/vyos_cert.py
deleted file mode 100755
index dc7c64684..000000000
--- a/src/conf_mode/vyos_cert.py
+++ /dev/null
@@ -1,147 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2019 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program. If not, see <http://www.gnu.org/licenses/>.
-#
-#
-
-import sys
-import os
-import tempfile
-import pathlib
-import ssl
-
-import vyos.defaults
-from vyos.config import Config
-from vyos import ConfigError
-from vyos.util import cmd
-
-from vyos import airbag
-airbag.enable()
-
-vyos_conf_scripts_dir = vyos.defaults.directories['conf_mode']
-
-# XXX: this model will need to be extended for tag nodes
-dependencies = [
- 'https.py',
-]
-
-def status_self_signed(cert_data):
-# check existence and expiration date
- path = pathlib.Path(cert_data['conf'])
- if not path.is_file():
- return False
- path = pathlib.Path(cert_data['crt'])
- if not path.is_file():
- return False
- path = pathlib.Path(cert_data['key'])
- if not path.is_file():
- return False
-
- # check if certificate is 1/2 past lifetime, with openssl -checkend
- end_days = int(cert_data['lifetime'])
- end_seconds = int(0.5*60*60*24*end_days)
- checkend_cmd = 'openssl x509 -checkend {end} -noout -in {crt}'.format(end=end_seconds, **cert_data)
- try:
- cmd(checkend_cmd, message='Called process error')
- return True
- except OSError as err:
- if err.errno == 1:
- return False
- print(err)
- # XXX: This seems wrong to continue on failure
- # implicitely returning None
-
-def generate_self_signed(cert_data):
- san_config = None
-
- if ssl.OPENSSL_VERSION_INFO < (1, 1, 1, 0, 0):
- san_config = tempfile.NamedTemporaryFile()
- with open(san_config.name, 'w') as fd:
- fd.write('[req]\n')
- fd.write('distinguished_name=req\n')
- fd.write('[san]\n')
- fd.write('subjectAltName=DNS:vyos\n')
-
- openssl_req_cmd = ('openssl req -x509 -nodes -days {lifetime} '
- '-newkey rsa:4096 -keyout {key} -out {crt} '
- '-subj "/O=Sentrium/OU=VyOS/CN=vyos" '
- '-extensions san -config {san_conf}'
- ''.format(san_conf=san_config.name,
- **cert_data))
-
- else:
- openssl_req_cmd = ('openssl req -x509 -nodes -days {lifetime} '
- '-newkey rsa:4096 -keyout {key} -out {crt} '
- '-subj "/O=Sentrium/OU=VyOS/CN=vyos" '
- '-addext "subjectAltName=DNS:vyos"'
- ''.format(**cert_data))
-
- try:
- cmd(openssl_req_cmd, message='Called process error')
- except OSError as err:
- print(err)
- # XXX: seems wrong to ignore the failure
-
- os.chmod('{key}'.format(**cert_data), 0o400)
-
- with open('{conf}'.format(**cert_data), 'w') as f:
- f.write('ssl_certificate {crt};\n'.format(**cert_data))
- f.write('ssl_certificate_key {key};\n'.format(**cert_data))
-
- if san_config:
- san_config.close()
-
-def get_config(config=None):
- vyos_cert = vyos.defaults.vyos_cert_data
-
- if config:
- conf = config
- else:
- conf = Config()
- if not conf.exists('service https certificates system-generated-certificate'):
- return None
- else:
- conf.set_level('service https certificates system-generated-certificate')
-
- if conf.exists('lifetime'):
- lifetime = conf.return_value('lifetime')
- vyos_cert['lifetime'] = lifetime
-
- return vyos_cert
-
-def verify(vyos_cert):
- return None
-
-def generate(vyos_cert):
- if vyos_cert is None:
- return None
-
- if not status_self_signed(vyos_cert):
- generate_self_signed(vyos_cert)
-
-def apply(vyos_cert):
- for dep in dependencies:
- command = '{0}/{1}'.format(vyos_conf_scripts_dir, dep)
- cmd(command, raising=ConfigError)
-
-if __name__ == '__main__':
- try:
- c = get_config()
- verify(c)
- generate(c)
- apply(c)
- except ConfigError as e:
- print(e)
- sys.exit(1)